Performance impact of using higher DH group for site-to-site VPNs

M.Pahlavanzadeh — Wed, 19 Nov 2025 23:47:43 GMT

“Clarification on the meaning and performance implications of ‘Integrated Crypto Assistant’ for PA-1420 IPSec VPNs”

Hi all,

I’m working with a PA-1420 appliance in a site-to-site VPN deployment and I’d like to better understand the hardware/crypto architecture. Specifically:

The PA-1420 architecture diagram lists “Integrated Crypto Assistant” as part of the data-plane.
My question: What exactly does “Integrated Crypto Assistant” mean in terms of dedicated crypto processors, offload capabilities, IPSec throughput (especially for strong DH groups like DH 14 or higher)?
From what I can tell: It seems the PA-1420 has enhanced crypto support compared to a purely generic CPU-only model, but it may not have full hardware-offload ASICs akin to the higher-end series.
I’d appreciate any TAC/field-experience details on:
- Per-flow throughput/limitation when using strong DH groups (DH 14/19/20/21) on PA-1420.
- Whether IPSec sessions on this model are fully offloaded or still largely handled by dataplane CPU cores.
- Practical monitoring tips for checking crypto/CPU bottlenecks on the PA-1420.

https://www.paloaltonetworks.com/resources/pa-series-next-generation-firewalls-hardware-architectures

Re: Performance impact of using higher DH group for site-to-site VPNs

BPry — Tue, 25 Nov 2025 14:42:13 GMT

@M.Pahlavanzadeh,

This is something that your SE should be able to provide you guidance on and is maybe the best resource to have this conversation. I've never noticed a perceivable difference using stronger DH groups on actual performance numbers, but there's obviously technically an increased overhead.

I'm pretty sure that what the "Integrated Crypto Assistant" is just the differences between Gen4 and Gen5 hardware and has more to do with quantum cryptography. Your SE can touch on this more as well since I'm not quite positive what features are already public and which are under roadmap where the differences between Gen4/Gen5 come into play.

topic Performance impact of using higher DH group for site-to-site VPNs in Next-Generation Firewall Discussions

Performance impact of using higher DH group for site-to-site VPNs

Re: Performance impact of using higher DH group for site-to-site VPNs